#!/usr/bin/env python3
"""Create the external Bridge Core Ed25519 signing keypair."""
import json, os
from pathlib import Path
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

PRIVATE = Path("/var/www/html/.platform-signing/wordpress-bridge-ed25519.pem")
PUBLIC = Path("/var/www/html/.platform-signing/wordpress-bridge-ed25519.pub.pem")
if PRIVATE.exists() or PUBLIC.exists():
    print(json.dumps({"status": "exists", "private": str(PRIVATE), "public": str(PUBLIC)}))
else:
    PRIVATE.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
    key = Ed25519PrivateKey.generate()
    fd = os.open(PRIVATE, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(fd, "wb") as stream:
        stream.write(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
    fd = os.open(PUBLIC, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)
    with os.fdopen(fd, "wb") as stream:
        stream.write(key.public_key().public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo))
    print(json.dumps({"status": "created", "private": str(PRIVATE), "public": str(PUBLIC)}))